#100 refactor(approvals): address review of #97 (inject trust paths, dedupe fs approval, forward category, honest capabilities)

[Anonymous]

Originally created by: sosidudku1

Addresses the review of [#97] (the five-level approval ladder), items R3 through R6. Follow-up, not a behavior change to the ladder itself.

R3 - Trust-config paths are injected, not looked up

fs-approval-scope no longer reaches into getConfig() for config.json and .env. Bootstrap resolves them once via getTrustConfigPaths(config.paths) and threads the list through registerOsTools into each fs tool, the same way workingDir arrives from ctx. The tools layer no longer owns knowledge of where the agent's trust surface lives. The C1 end-to-end test (a config.json write at level 4 prompts as trust_config) now runs through the production injection path, not a test seam.

R4 - One funnel for fs approval

os.fs.write / edit / patch / trash / archive.extract shared the same categorize-then-requireApproval pattern copied five times. A new requireFsApproval helper does it in one call, with the scope inputs (workingDir, trustConfigPaths) travelling in the same request object as the prompt, so the next mutating tool cannot half-wire the ladder or forget trust_config. Extract's destDir categorization and its exemption from the trust-config guard stay encapsulated behind the kind discriminator.

R5 - Category forwarded to host UX

ApprovalRequest.category is now shown to the operator, not just consumed by the gate. The TUI approval modal, the CLI prompt, and the Telegram bridge render a human label ("file write . home", and so on) via an exhaustive APPROVAL_CATEGORY_LABELS map. The sidecar payload gains an optional category field (old hosts without it keep working); the SSE stream already carried the full request. The Tauri host renders it on its side as a follow-up; nothing is dropped on the wire.

R6 - Honest capabilities

GET /api/capabilities treats approvalLevel as the source of truth. The derived approvalRequired (level < 5) is documented as deprecated approximate compatibility, and the route comment now states the imprecision spans every mid-ladder level (2 and 3 silence file writes, 4 silences shell / script / kill), not only level 4.

Testing

tsc clean. Targeted approval / tools / http / runtime / config / sidecar / telegram / tui suites green, zero regressions. Category round-trip plus a pre-ladder (no-category) back-compat case added to the sidecar stdio-protocol suite; the approval label matrix, modal render, and Telegram bridge label are pinned too. Full-suite delta against origin/main is zero new failures (the same pre-existing floating failures on both sides).

[Anonymous]

Ticket changed by: sosidudku1

• status: open --> closed